I have the same issue. Panorama 10.1.5 accepting logs from a number of gateways (most being 9.1.13). Threat log allocation, for example, is 64GB. Expiration Period is 90 days. However the logdb-usage command lists 'Current Retention' as 12 days. 64GB should be enough for millions of log entries allowing for at least 90 days. If i export the entire 12 days of threat logs, that is only 80,000 entries.
The PA tech i spoke with suspects the allocated space is clogged up with indexes rather than with actual logs. However he is not yet sure how to check.
... View more